Demonstrating CMMC Compliance with Unified PAM

CMMC Domain

The access control domain is regarding access controls, rights and authorization to access data and resources. It encapsulates account assignment and depicts how passwords and credentials are used. This domain also highlights provisioning and elevating access to privileged accounts. In summary it requires organizations to:

• Establish system access requirements
• Control internal system access
• Control remote system access
• Limit data access to authorized users and processes

Securden Unified PAM Capabilities

Securden Unified PAM can be utilized to satisfy all the access control recommendations related to managing privileged and administrative identities. This includes discovery and management of privileged accounts, and comprehensive auditing of sensitive access.

• It lets you assign users roles and therefore varying levels of permissions and capabilities (RBAC) – based on their needs.
• Sensitive accounts and systems added to Unified PAM can be classified into folders and access to these accounts can be granted by designating approvers.
• Remote access capabilities let users and third-party vendors launch secure one-click SSH/SQL/RDP connections to IT assets.
• Endpoint privilege elevation and delegation management allows administrators to define exactly who can access what on a particular system.

CMMC Domain

The asset management domain involves gathering insights on assets and keeping an asset inventory.

• Identify and document assets
• Manage asset inventory

Securden Unified PAM Capabilities

Securden Unified PAM helps with discovery of IT assets and create an inventory within the PAM solution. It also identifies certain attributes of these systems like their operating system (OS). Users can utilize PAM to directly launch connections to these assets.

CMMC Domain

The asset management domain involves gathering insights on assets and keeping an asset inventory.

• Define audit requirements
• Perform secure auditing
• Identify and protect audit information
• Review and manage audit logs Identify and document assets

Securden Unified PAM Capabilities

Securden Unified PAM ensures that all system account activity can be traced back to the users who performed them. This holds them accountable for their actions

• Logged activity and events can be comprehensively reviewed, alerts can be generated in cases of failure.
• All audit data are stored centrally and can be retained as long as needed by the organization. Audit logs can also be selectively sent to SIEM solutions.
• All audits capture comprehensive information including the date, time and system information where the event occurred.
• Audits are protected from tampering – they are securely vaulted with AES-256 encryption, and users cannot edit or change audit logs in any way.
• Role based access controls ensure that only authorized privileged users can view audit logs and generate reports when necessary.

CMMC Domain

The identification and authentication domain involves controls to verify user identities, devices and processes. It also enforces password complexity requirements and multi factor authentication to access privileged accounts.

• Identify users, systems and verify them before allowing access to system information.
• Enforce a minimum password complexity and prohibit password re-use
• Enforce MFA and optionally SSO for access to privileged accounts

Securden Unified PAM Capabilities

Securden Unified PAM ensures that all users and shared accounts are identified through verification and passwords are complex and rotated.

• Robust authentication mechanisms, including multi-factor authentication (MFA) and single sign-on (SSO) can ensure that only authorized personnel can access privileged accounts.
• Privileged passwords can be generated based on pre-defined complexity rules (by defining a password policy) and password re-use and hard coded password use can be fully eliminated.
• All passwords are encrypted and stored, as well as protected cryptographically during transit.
• Periodic password resets can be configured to ensure that passwords never remain the same for a long time.

CMMC Domain

The system and communications protection domain is about securing systems and communications. It includes:

• Monitoring, controlling, and protecting organizational communications
• Specifics behind individual components that make up the domain.

Securden Unified PAM Capabilities

Securden Unified PAM helps by securing privileged sessions through encryption and secure tunneling to protect communication channels. Privilege elevation and delegation capabilities allow users to gain elevated privileges as and when needed. This prevents unauthorized access and mitigates the risk of breaches.